Liquid Attacker Returns 3,400 BTC After Bridge-Node Patch, Keeps 598.5 BTC

Key Facts

The party that withdrew about 4,000 BTC from Liquid's federation wallet returned 3,400 BTC after bridge nodes were reported patched, while about 598.5 BTC remained in its wallet. The returned transfer represents roughly 85% of the amount withdrawn.

The incident began on Sept. 6, when about 4,000 BTC—valued at roughly $320 million at the time—left the federation wallet. Liquid said the withdrawal used SideSwap's Peg-out Authorization Key, or PAK, without compromising the key; network activity was subsequently paused and bridge nodes were disabled.

SideSwap said a customer sent 4,000 L-BTC to its peg-out service and that the tokens were burned through a valid authorization flow before the federation paid 3,996 BTC to the customer's address.

Liquid's documentation says every L-BTC should be backed by an equivalent amount of BTC under a 1:1 peg; during a peg-out, L-BTC is burned and the federation releases BTC on the Bitcoin mainchain. The available evidence therefore points to a failure in the sidechain's federated peg mechanism, not a compromise of the Bitcoin mainchain itself.

Blockstream said in a Sept. 7 update that updated software had been deployed and federation members were preparing for a coordinated restart while continuing to harden the network. The update did not provide a restart time or a detailed technical explanation of the root cause.

EL7 data showed BTCUSD closing at $78,410.01 on Sept. 8, within a daily range of $78,261.61 to $79,485. Price data alone cannot attribute BTC's movement to the Liquid incident; the main operational issues are the fate of the remaining 598.5 BTC, the network restart and publication of a detailed postmortem.